Roundcube Webmail known exploited vulnerabilities, ranked
CISA lists 7 Roundcube Webmail CVEs as exploited in the wild. 2 were added in the last 12 months and 0 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2025-49113: EPSS 98.9%, added 2026-02-20
- CVE-2024-42009: EPSS 82.9%, added 2025-06-09
- CVE-2020-13965: EPSS 76.6%, added 2024-06-26
- CVE-2023-5631: EPSS 75.9%, added 2023-10-26
- CVE-2024-37383: EPSS 73.3%, added 2024-10-24
All 7 Roundcube Webmail CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2025-49113 | RoundCube Webmail Deserialization of Untrusted Data | 98.9% | – | 2026-02-20 | 2026-03-13 |
| 2 | CVE-2024-42009 | RoundCube Webmail Cross-Site Scripting | 82.9% | – | 2025-06-09 | 2025-06-30 |
| 3 | CVE-2020-13965 | Webmail Cross-Site Scripting (XSS) | 76.6% | – | 2024-06-26 | 2024-07-17 |
| 4 | CVE-2023-5631 | Webmail Persistent Cross-Site Scripting (XSS) | 75.9% | – | 2023-10-26 | 2023-11-16 |
| 5 | CVE-2024-37383 | RoundCube Webmail Cross-Site Scripting (XSS) | 73.3% | – | 2024-10-24 | 2024-11-14 |
| 6 | CVE-2023-43770 | Webmail Persistent Cross-Site Scripting (XSS) | 63.7% | – | 2024-02-12 | 2024-03-04 |
| 7 | CVE-2025-68461 | RoundCube Webmail Cross-site Scripting | 26.8% | – | 2026-02-20 | 2026-03-13 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Roundcube KEV CVEs · free KEV badge for Roundcube · all vendors